todo remove

modules/nixos/services/grafana/default.nix

@@ -52,7 +52,7 @@ let
       name = "node-exporter-full.json";
       path = patchDashboard "node-exporter-full.json" (pkgs.fetchurl {
         url = "https://grafana.com/api/dashboards/1860/revisions/latest/download";
-        sha256 = "sha256-IeQ72CZhtckDEihcVLhAFuSs77uWsZSENsdomSrWTHo=";
+        sha256 = "sha256-GExrdAnzBtp1Ul13cvcZRbEM6iOtFrXXjEaY6g6lGYY=";
       }) "ds_prometheus";
     }
     {

modules/nixos/services/nextcloud/default.nix

@@ -147,8 +147,18 @@ let
           # "Service has no ExecStart=, ExecStop=, or SuccessAction=. Refusing."
           nextcloud = lib.mkForce { };
           nextcloud-setup = {
-            after = [ "postgresql.service" ];
-            requires = [ "postgresql.service" ];
+            # Also require the NAS bcachefs mount so that ExecStartPre can create
+            # the store-apps and config directories on the actual NAS filesystem.
+            # Without this, the dirs are created on the root tmpfs overlay before
+            # the mount comes up, and the real NAS store-apps path never exists.
+            after = [
+              "postgresql.service"
+              "media-nas-main.mount"
+            ];
+            requires = [
+              "postgresql.service"
+              "media-nas-main.mount"
+            ];
             serviceConfig =
               let
                 # Extract the override.config.php store-path from the already-evaluated
@@ -235,8 +245,46 @@ let
               };
           };
           nextcloud-update-db = {
+            after = [
+              "postgresql.service"
+              "media-nas-main.mount"
+            ];
+            requires = [
+              "postgresql.service"
+              "media-nas-main.mount"
+            ];
+          };
+          nextcloud-cron = {
+            after = [ "media-nas-main.mount" ];
+            requires = [ "media-nas-main.mount" ];
+          };
+          phpfpm-nextcloud = {
+            after = [ "media-nas-main.mount" ];
+            requires = [ "media-nas-main.mount" ];
+          };
+          # One-shot repair for the oc_filecache_extended duplicate key constraint
+          # violation that causes nextcloud-cron to fail with:
+          #   "duplicate key value violates unique constraint oc_filecache_extended_pkey"
+          # Runs as the postgres user before nextcloud-setup so that the DB is clean
+          # before Nextcloud starts. Idempotent: only removes rows whose fileid does
+          # not exist in oc_filecache (true orphans). Remove this service once the
+          # underlying Nextcloud bug is fixed and a clean run confirms cron succeeds.
+          nextcloud-repair-filecache = {
+            description = "Repair orphan rows in oc_filecache_extended";
+            wantedBy = [ "nextcloud-setup.service" ];
+            before = [ "nextcloud-setup.service" ];
             after = [ "postgresql.service" ];
             requires = [ "postgresql.service" ];
+            serviceConfig = {
+              Type = "oneshot";
+              User = "postgres";
+              ExecStart = pkgs.writeShellScript "nextcloud-repair-filecache" ''
+                ${pkgs.postgresql}/bin/psql -d nextcloud -c "
+                  DELETE FROM oc_filecache_extended
+                  WHERE fileid NOT IN (SELECT fileid FROM oc_filecache);
+                "
+              '';
+            };
           };
         };
       };